KeyboardCrumbs MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| check_ipA | Look up threat intelligence for an IP address. Returns risk score, geolocation, ASN, malware C2 associations, active GhostWatch staging clusters, Tor exit status, and data sources. Use this when investigating a suspicious IP from a log, alert, or report. Args: ip: IPv4 or IPv6 address to look up (e.g. 45.141.26.73) |
| check_cveA | Look up a CVE — exploitation status, KEV listing, EPSS score, and available exploits. Returns CVSS score, severity, EPSS probability, whether it's in the CISA Known Exploited Vulnerabilities catalog, exploit availability, and KEV Oracle prediction data. Use this to assess patch urgency for a specific vulnerability. Args: cve_id: CVE identifier (e.g. CVE-2024-3400 or CVE-2021-44228) |
| check_domainA | Look up threat intelligence for a domain. Returns DNS records, WHOIS age, certificate transparency data, malware associations, and threat feed cross-references. Use this when investigating a suspicious domain. Args: domain: Domain name to look up (e.g. example.com) |
| check_hashA | Look up a file hash to check if it's known malware. Checks against VirusTotal (68+ AV engines) and CIRCL hashlookup (6.3 billion known files). Returns malware family, detection count, and file metadata. Use this when investigating a suspicious file. Args: file_hash: MD5, SHA1, or SHA256 hash of the file |
| active_threatsA | Get a snapshot of current live threat intelligence. Returns database freshness, top statistics: KEV count, active C2s, ransomware victims, exploits, and when data was last updated. Use this for a quick situational awareness check. |
| predict_kevA | Get KEV Oracle predictions — CVEs most likely to be added to CISA KEV soon. Scores unpatched CVEs by EPSS, exploit availability, ransomware association, and in-the-wild exploitation. Returns the top predicted CVEs ranked by likelihood of CISA KEV addition. Use this for proactive patch prioritization. Args: limit: Number of predictions to return (default 10, max 25) |
| check_stagingA | Check if an IP or domain is associated with a GhostWatch pre-attack staging cluster. GhostWatch detects infrastructure being staged for attacks before it's weaponized — the quiet window when attackers spin up C2s, register domains, and issue certs. Returns cluster details, confidence score, signal count, and AI threat assessment. Args: indicator: IP address or domain to check for staging activity |
| check_ransomwareA | Look up ransomware group activity or check if a company has been a victim. Search by ransomware group name (e.g. 'LockBit', 'BlackCat') or company/domain name to check victim feeds. Returns group stats, recent victims, and target industries. Args: query: Ransomware group name OR company name / domain to check |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool has a clearly distinct purpose targeting different threat intelligence aspects: active threats overview, CVE lookup, domain/IP/hash investigation, ransomware tracking, staging detection, and KEV prediction. The descriptions specify unique use cases (e.g., 'quick situational awareness' vs. 'assess patch urgency'), preventing confusion between tools.
All tools follow a consistent 'check_' or descriptive verb_noun pattern (active_threats, check_cve, check_domain, check_hash, check_ip, check_ransomware, check_staging, predict_kev). The naming is uniform with snake_case throughout, making it predictable and easy to understand.
With 8 tools, the server is well-scoped for its threat intelligence domain. Each tool addresses a specific need (e.g., different indicator types, ransomware, staging clusters), and none feel redundant or missing, providing comprehensive coverage without being overwhelming.
The tool set offers complete coverage for threat intelligence workflows: it includes real-time overviews (active_threats), detailed lookups for various indicators (CVE, domain, hash, IP), specialized checks (ransomware, staging), and predictive analytics (predict_kev). There are no obvious gaps, enabling agents to handle diverse security investigation tasks.